AU Small Finance Bank (India): potential leak of...

What happened

The bank said on 30 Oct it is “investigating a potential data leak involving a software-as-a-service (SaaS) platform” managed and hosted by Salesforce that “holds limited data relating to our vehicle loan customers”, and that “the Bank’s own systems remain unaffected”. It did not say how many customers are affected or whether the claimed data came from that platform (PTI via ThePrint; Inc42).
Root cause: not disclosed. ThePrint notes that 2025 attacks on Salesforce customers used voice phishing to get staff to connect rogue apps, but says there is no evidence linking the AU claim to them. No Salesforce statement on this incident appears in the sources checked.
Attacker: ScarlettGroup, flagged by Hackmanac on X on 29 Oct. It claims KYC records, PAN and Aadhaar details, credit reports, bank statements, loan applications, signed agreements, insurance records, CRM data, employee information and audit logs. Its leak-site listing was marked “negotiation” with a countdown and no samples (MediaNama). Unverified.
Response: investigation under way; shares fell about 1.8 to 1.9% on 30 Oct. No exchange filing, RBI or CERT-In action reported in the sources.